The UK General Data Protection Regulation gives every UK resident powerful legal rights over their personal data. Most people are unaware of these rights or do not know how to exercise them. This guide explains every right you have and exactly how to use them.
Organisations must tell you what data they collect about you, why they collect it, how long they keep it and who they share it with. This information must be provided in a privacy notice that is easy to understand.
You can request a copy of all personal data any organisation holds about you. This is called a Subject Access Request (SAR). They must respond within 30 days and provide the information free of charge. This applies to any organisation — companies, government bodies, charities and data brokers.
If an organisation holds inaccurate personal data about you they must correct it without undue delay when you request it. They must also notify any third parties they have shared the incorrect data with.
You can request that any organisation delete your personal data. They must comply within 30 days unless they have a specific legal reason to retain it. This is the most powerful right for removing your data from data broker sites and Google search results.
You can request that an organisation temporarily stop processing your data while a dispute is resolved — for example while you contest the accuracy of your data or object to its use.
You can request your personal data in a portable machine-readable format to transfer to another service provider. This is most useful when switching between services like banks or email providers.
You can object to processing of your data for direct marketing at any time. This right is absolute — the organisation cannot refuse. You can also object to other types of processing based on legitimate interests.
You have the right not to be subject to decisions made solely by automated processing — including profiling — that significantly affect you. This includes automated credit decisions, recruitment screening and insurance pricing.
Send this letter to any organisation to request all personal data they hold about you:
If an organisation refuses your GDPR request they must give you a reason. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk or call 0303 123 1113. The ICO can investigate and issue fines of up to £17.5 million for serious breaches.
Generate professional GDPR letters instantly or let Silent Erase send them for you automatically